Understand what spoofing disguises
Telling whether you’re being spoofed starts with checking whether the displayed sender matches the behavior. A spoofed call, text, or email may look familiar, official, or local, but the message pushes urgency, payment, account access, sensitive data, or suspicious links. Verify through a separate trusted channel.
Spoofing is about disguise. The scammer wants the phone number, caller ID, sender name, email display name, or reply address to make you trust the request before you inspect it.
The right response is a pause. Do not click, pay, reply with codes, or call back from the message until you have verified the source.
Check phone number spoofing signs
A spoofed number may look local, familiar, or tied to a real organization. Neighbor spoofing uses nearby-looking numbers because people are more likely to answer. BBB has warned about neighbor spoofing and its effect on call trust.
Watch the behavior, not just the number. Threats, gift cards, crypto, wire transfers, one-time codes, and pressure to stay on the line are stronger signals than caller ID.
If you are checking an unfamiliar number, a reverse phone lookup can provide public context. It cannot prove who placed a spoofed call, because the displayed number may belong to an uninvolved person.
Even without proof of the caller’s identity, you can still cut the volume, and the steps for blocking spam calls cover repeat numbers, unknown callers, and carrier protection.
Inspect email spoofing signs
Email spoofing often uses a trusted display name with a different sending address, reply-to address, or domain. The visible name may say your boss, bank, or vendor while the real address is slightly wrong.
Open the sender details before replying. Look for misspelled domains, free email accounts pretending to be businesses, odd attachments, urgent invoice changes, or links that do not match the claimed organization.
Headers can also help, but most people do not need to analyze every field. If the message asks for payment, passwords, gift cards, payroll changes, or tax forms, verify through a known phone number or internal system instead of replying.
For workplaces, require a second approval path for bank-account changes, vendor payment changes, and employee tax-document requests every single time.
Spoofed addresses usually arrive wrapped in a phishing message, and the walkthrough on spotting phishing emails covers the sender, link destination, tone, and attachment checks worth running every time.
Use a quick spoofing checklist
| Signal | Phone/Text | |
|---|---|---|
| Urgency | Threats, arrest, account lock, delivery problem | Invoice due, payroll change, account shutdown |
| Identity mismatch | Caller ID does not fit the story | Display name and email address differ |
| Payment demand | Gift cards, wire, crypto, payment apps | New bank details or unusual invoice route |
| Verification dodge | Refuses callback through official number | Pushes reply instead of official portal |
For phone-specific background, see our guide to caller ID spoofing.
Tell a spoofed message from a real mistake
Telling a spoofed message from an ordinary mistake comes down to control. A real business, friend, or agency can tolerate a callback through a known channel. A scammer tries to keep you inside the call, thread, or email chain they control.
Use a separate route. Open the company’s app, type the website yourself, call the number printed on a card or statement, or message the person through an account you already trust. Do not use links or callback numbers inside the suspicious message.
If the sender claims to be someone you know, ask a question through another channel. A stolen photo, familiar display name, or local-looking number can all be copied.
Respond based on your exposure
What to do next depends on whether you received a spoofed message, clicked something, paid money, or your own number or identity is being used. Start by preserving evidence: screenshots, headers, displayed numbers, links, dates, payment records, and voicemails.
Change the next step based on risk. A strange call can be blocked. A clicked link may require password changes and malware checks. A payment or shared Social Security number needs bank, credit, or identity-theft steps right away.
If you received the message but did not act, report and block. The FTC’s reporting site at reportfraud.ftc.gov and BBB Scam Tracker at bbb.org/scamtracker can help document patterns. FCC consumer complaint resources at consumercomplaints.fcc.gov may apply to unwanted or spoofed calls.
If you sent money or shared credentials, contact the bank, card issuer, payment provider, employer, or account platform immediately. Change passwords from a trusted device and warn contacts if your email or number is being impersonated.
Handle misuse of your own number
You may learn this when strangers call back angrily about calls you never made. Do not argue. Explain briefly that your number appears to have been spoofed and ask them to block the suspicious call.
Most spoofing waves move on. If the volume is high or threatening, keep a log and contact your carrier. A people search is not the right tool to confront callers; the displayed number may not reveal the scammer.
Frequently asked questions
How can you tell if a phone number is spoofed?
You may not be able to prove it from caller ID alone. Suspect spoofing when the number looks local or official but the caller demands money, codes, secrecy, or immediate action. Hang up and call the organization through a published number.
How can you tell if your phone is spoofed?
If people say they received calls or texts from your number that you did not send, your number may be spoofed. Your phone may not be hacked. Keep notes, contact your carrier if it continues, and warn contacts if needed.
How can you tell if an email is spoofed?
Check the full sender address, reply-to address, domain spelling, links, attachments, and request. A trusted display name is not enough. Verify payment, password, payroll, tax, or account-change requests through a separate trusted channel.
