Caller ID is a claim, not a proof. When your accounts payable clerk sees "IRS" or your bank's name on an incoming call, the phone is showing whatever the calling system sent. Carriers have added call-signing (STIR/SHAKEN) to make spoofing harder, but a familiar name or number on the screen still doesn't tell your staff who is actually calling. The fix is a habit, not a gadget: verify through a channel you already trust, every time money or credentials are involved.

This guide is for the finance and operations people who answer those calls. The first half covers how to check a caller independently. The second half covers what your business can do so its own numbers are harder to impersonate when scammers target your customers. We make Ready, a texting and calling platform, so we'll point out where registration and sender identity help. We'll also say plainly where no tool solves the problem.

Why caller ID can't be trusted on its own

Phone networks were built to pass along the caller's number as information, not to authenticate it. Anyone with access to a calling system can set the displayed number, and sometimes the displayed name, to whatever they want. STIR/SHAKEN lets the originating carrier sign a call and say how confident it is that the caller has the right to use that number. Many phones and carriers use that signal to label calls as verified or as likely spam.

The signal has limits:

  • Not every call carries a full attestation. Calls that cross older networks or international gateways can lose the signature or arrive with a weaker one.
  • The caller name is a separate lookup. A number can be signed while the name display comes from a database the caller doesn't control, or one that's simply wrong.
  • A "verified" label means the number is legitimately in use by the caller. It doesn't mean the caller is who they say they are. A scammer with a real number can still say "this is your bank."

The practical rule for staff is simple. The phone screen tells you where to start asking questions. It doesn't answer them.

How to verify an IRS call

The IRS pattern is well documented on irs.gov. Your team should know it by heart:

  • The IRS normally starts with a letter. A first contact by phone with no prior notice is a red flag. Some IRS agents do call or visit, but usually after mail has been sent.
  • The IRS doesn't demand immediate payment by gift card, wire, crypto or prepaid debit card. It doesn't threaten arrest or deportation over the phone, either.
  • You can always hang up and call back. Use the phone number printed on the notice, or the number listed on irs.gov. Never use a number the caller gives you or one left in a voicemail.
  • Ask for the notice number. A real agent will reference a specific letter. If nobody at your company has that letter, find it before you discuss anything.

If the call claims to come from a state tax agency, apply the same logic. Hang up, find the agency's number on its official .gov site, and call back.

How to verify a bank or vendor call

Bank and vendor impersonation hits finance teams harder than IRS scams. The asks look routine: "confirm this wire," "we've changed our remittance account," "read me the code we just texted you."

The callback rule

Hang up and call a number you already had before this call came in:

  1. Banks: use the number on the back of the company card, on a recent statement, or in your treasury portal.
  2. Vendors: use the contact on file in your AP system or the signed contract. Don't use the number in the email or invoice that asked for the change.
  3. Internal "executives": call the person's known mobile or desk line, or walk over. A rushed call from "the CFO" asking for a same-day wire is one of the oldest patterns there is.

Things a real bank won't ask for on an inbound call

  • Your online banking password or full PIN
  • A one-time passcode that was just texted to you. Those codes exist so you type them in yourself, never read them back to anyone. Our post on SMS OTP and verification APIs explains why a code that leaves the person who received it defeats the whole design.
  • A transfer "to a safe account" to protect your money

Internal controls that make one bad call survivable

Verification habits fail when someone is tired or rushed, so back them with process:

  • Dual approval for any new payee or change to banking details
  • A waiting period on banking-detail changes, confirmed by callback to the contact on file
  • A written list of numbers your bank, payroll provider and top vendors actually call from, kept where AP staff can find it
  • A no-blame reporting path, so the person who almost wired money tells someone the same day

The text message version (smishing)

The same scam shows up as texts: "Your account is locked, tap here," "IRS refund pending," "Confirm this $2,400 charge." The checks barely change:

  • Don't tap the link. Open the bank's app or type its site address yourself.
  • Don't reply with codes, account numbers or "YES" to unexpected prompts.
  • A sender number that looks local or familiar proves nothing, same as with calls.

If you want to know what kind of number texted you, our 10DLC number lookup guide explains what the terms mean. A lookup is useful context. It still isn't proof of who is behind the message.

Protecting your own numbers from impersonation

Now flip it around. If you're a bank, clinic, utility, lender or any business whose customers expect calls and texts from you, scammers may borrow your name. You can't make spoofing impossible. You can make the real you easier to recognize and the fake you easier to spot.

1. Publish a short, stable list of official numbers

Put the numbers you call and text from on your website, in onboarding emails and on statements. Keep the list short and don't rotate numbers casually. "We will only ever text you from these numbers" is a sentence customers can actually act on.

2. Tell customers what you will never ask for

Spell it out, the way banks print it on statements: "We will never ask for your password, full card number or a code we texted you." Then make sure your own staff and scripts never ask for those things. One legitimate call that asks for a code teaches customers that scammers asking for codes are normal.

3. Register your business texting

US carriers expect business texts from 10-digit numbers to run on a registered A2P 10DLC brand and campaign. Unregistered traffic gets carrier-filtered. Registration also ties your traffic to a verified business identity and a declared use case. That doesn't stop a scammer from spoofing you, but it puts your real messages on a traceable, accountable route.

On Ready, registration is handled in the app. There's no setup fee. You pay the first month, $25, when you submit, and after that it's $25/mo for registration and $2 per number. Most approvals take 2 to 7 days. Our post on 10DLC rules and requirements covers what carriers actually check.

4. Keep sender identity consistent

Use these habits:

  • Name the business in every message, not just the first one.
  • Link only to your own domain. Don't use link shorteners that hide where a link goes.
  • Keep each workflow on the same numbers. Ready's local presence picks the account's number closest to the contact's area code, but every one of those numbers sits on your registered campaign. A contact also keeps texting with the number it already knows.

5. Consider a branded iMessage line for iPhone customers

Ready's blue line sends texts as iMessage, so they appear blue on iPhones with your business name and photo. It costs $99 a month per line plus 6 cents a segment, and texts to Android phones go out from your regular number. A consistent name and photo help customers recognize you. To be honest about it, though, that's a recognition signal, not a security guarantee. Pair it with the "we'll never ask for" message above.

6. Watch for impersonation reports

If customers start replying "did you just call me?" or "I didn't request this code," take it seriously. Log those reports, note the numbers and times, and send an alert to affected customers.

Worked example: an "official numbers" notice

Here's the arithmetic for warning customers once you know your name is being spoofed. The example assumes 2,000 customers who have opted in to account texts, and a plain-text notice under 160 GSM-7 characters with no emoji:

"Acme Credit Union: we only text from this number and never ask for codes or passwords. Report suspicious calls at example.com/fraud. Reply STOP to opt out."

That's 1 segment per customer, so 2,000 segments total.

  • Ready Standard rate: 2,000 × $0.0075 = $15.00
  • Carrier fee: 2,000 × $0.0045
  • That all-in figure excludes the compliance surcharge. Scrubbing and landline validation each add $0.003 per segment if you switch them on, and both are off by default.

Add one emoji and the message drops to a 70-character limit. A text this long would then split into 3 segments, which triples the cost. Keep fraud notices plain. Ready sends replies like "is this really you?" to your inbox, and those replies are billed like a sent text.

A developer can send the same notice through POST /v1/messages/bulk, which takes up to 100 recipients per call. See the bulk messages docs. Opted-out numbers are refused up front and not charged.

The short version

For your staff: caller ID is a starting point. Hang up and call back on a number you already had, never read out a code, and require two people for any banking change.

For your business: publish your official numbers, tell customers what you'll never ask for, register your texting, and keep your sender identity boring and consistent. None of this makes impersonation impossible. It makes the real you recognizable and gives customers a clear way to check.

If you need registered business texting for those notices, you can set up an account. The first 20 one-to-one texts are free, so use them to test your wording before you register. To send, you add a card and get a number, which is $2 a month with the first month charged when you get it.