November 13, 2019

Why is Call Spoofing Legal? Ethical Uses for Call Masking

When you hear about call spoofing, you may think of something bad. That’s because many scammers and spammers use call spoofing to try to mask their identities. The reason that call masking remains legal is there are also many legitimate business uses for it.

What are Call Spoofing and Call Masking?

Call spoofing and call masking both refer to the practice of making the call receiver’s caller ID show a different number than you’re actually calling from. There are a variety of reasons to do this, however they primarily gain attention from fraudulent activity.

Call Spoofing

Spoofing is more commonly used in the scam context. That’s the criminal trying to make it appear as if they’re calling from a phone number belonging to your bank or the IRS. It can also be the spammer who makes it look like they’re calling from a local phone number so that you’re more likely to answer the call.

Call Masking

Masking is more commonly used to describe legitimate uses of the same practice. That might be a business trying to make it look like its dozens of phone lines are all calling from the same customer service number, or an online marketplace allowing buyers and sellers to talk to each other while maintaining the privacy of their actual phone numbers.

Both terms are generally interchangeable, though, so you might hear call spoofing referring to legal activities and call masking referring to illegal activities.

Business Uses of Call Masking

Business call masking isn’t just legal. It’s a fully legitimate and beneficial customer service technique used by many major businesses. It’s beneficial to both the business and customers.

Two of the most common users are Uber (ridesharing) and Wag (dog walking). Their riders and drivers or dog owners and dog walkers need to be able to talk to each other, but everybody still wants to maintain the privacy of their personal phone numbers. The platforms have many happy customers, but people are still wary of the occasional creep.

The way these calls work is that the companies generate a temporary phone number that’s active immediately before and after the service. This number forwards to the user’s actual phone number while working just like a normal call.

Other companies that use outsourced or work-at-home customer service may also use call masking. In those cases, the worker’s calls appear to be coming from each company’s main hotline.

Even when the company has everyone in a central call center, they still need to use direct inward dialing or (DIDs). These are virtual numbers that can be assigned to agents for outbound calls. Masking is sometimes used to show outbound calls being placed from a single support number rather than to each worker’s personal line.

How Does Caller ID Masking Work?

When you use call masking, calls route through a Voice API such as Twilio or Nexmo. Larger companies may also choose to build their own infrastructure. On a platform, like Uber, that uses temporary numbers, the process is as follows.

1. The platform reserves a range of phone numbers such as 555-1000 to 555-1999.
2. When a customer books a ride, the system assigns that ride a temporary number. For example, 555-1001.
3. If the driver calls or texts the customer, the customer sees 555-1001 instead of the driver’s actual number. When the customer calls or texts the driver, the driver also sees 555-1001 instead of the customer’s own number.
4. A few hours after the ride, the 555-1001 number will be deactivated. This prevents one party from harassing the other or trying to solicit business away from the platform. Eventually, the 555-1001 number recycles back into the system for another new ride.

There are two differences between this process and criminal call spoofing or call masking. First, the criminals make the call appear to be coming from someone else’s number rather than their own. Second, the criminals don’t control the number they’re displaying. Attempts to call that number back will go to its real owner rather than the criminal. And importantly, the intent of the call is typically to defraud using a legitimate business’ information to appear credible.

Understanding the Legality Behind Call Masking:

These real business uses are why call masking remains legal. The businesses aren’t trying to deceive customers — they’re trying to efficiently handle calls, give customers peace of mind, and allow customers to receive calls from recognizable numbers.

This is exactly what the Truth in Caller ID Act of 2009 states:

(1) IN GENERAL. — It shall be unlawful for any person within the United States, in connection with any real time voice communications service, regardless of the technology or network utilized, to cause any caller ID service to transmit misleading or inaccurate caller ID information, with the intent to defraud or deceive.

This law applies to any VoIP services or phone communications you use to place outbound calls or texts. The question you may have is if it’s “deceiving” to show a different number than the number that’s actually being used. “Deceive and defraud” refer more to who’s calling and why rather than the actual phone number in use.

Ethical Masking Examples:

• If you want calls showing and going to a central business line, you’re making it more clear to customers who they’re calling and getting calls from.
• For platforms connecting buyers and sellers, it’s safer to use contact information that you’ve verified rather than allow them to provide their own, possibly faked, means of contact.

Again, it comes down to the intent — was the masking for malicious purposes or business convenience?

Knowing the Differences in Call Masking

Call masking is a common technique used by businesses to give customers recognizable phone numbers and to protect their privacy. However, it has also been appropriated by scammers, but that doesn’t make it illegal or bad to use for legitimate purposes.

There are other laws already in place to control scammers. Knowing the legal uses for masking and spoofing can help understand the careful wording used by the FCC when it creates litigation to combat spammers.

With an increase in illegal caller ID spoofing cases, keeping your business numbers protected is essential. Scan your numbers frequently to ensure they are not appearing as spam or “scam likely”. These could be indications that someone is spoofing your outbound numbers.