Spoofing means disguising a communication so it appears to come from a trusted source. A caller fakes the number on your caller ID, a scammer forges the sender address on an email, a trader places orders they never intend to fill. The act of disguising an identity is not automatically a crime. Under federal law, spoofing crosses into illegal territory when it is done with the intent to defraud, cause harm, or wrongfully obtain something of value.
That intent requirement is the heart of the law. A doctor who displays the office main line instead of a personal cell is altering caller ID, but not spoofing in the legal sense. A scammer who displays the number of a local bank to trick you into handing over account credentials is.
The Forms Spoofing Takes
Spoofing covers a range of techniques that share one trait: the sender is not who they appear to be.
Caller ID spoofing. The caller uses Voice over Internet Protocol (VoIP) services to select any number as the outgoing caller ID. A local area code or a number that mimics a bank, government agency, or familiar contact increases the chance the call will be answered.
Email spoofing. The sender alters the header information in an email so the message appears to come from a recognized business or trusted contact. Recipients who believe the source is verified are more likely to click a link, open an attachment, or hand over login credentials.
Text message spoofing. The sender disguises their number so a text appears to come from a bank, delivery service, or other familiar source, often with a link to a site built to harvest personal information. Federal law treats text messages as a type of telephone call, so the same prohibitions on misleading caller identification apply.1Federal Communications Commission. Unlawful Communications: Robocalls, Caller ID Spoofing, Do-Not-Call Registry, and Junk Faxes
IP address spoofing. Operating at the network level, the attacker sends data packets with a false source address to bypass security filters, hide their origin, or impersonate another system.
Website and domain spoofing. A fraudulent site is built to look nearly identical to a legitimate one, usually a bank, payment processor, or government agency. The fake domain uses a slight variation of the real address, like a zero in place of the letter O. Trademark owners can act against bad-faith registrations of confusingly similar domains under the Anti-Cybersquatting Consumer Protection Act.2Office of the Comptroller of the Currency. Threats from Fraudulent Bank Websites: Risk Mitigation and Response Guidance for Website Spoofing Incidents
AI-generated voice spoofing. A scammer uses artificial intelligence to clone someone’s voice — a family member, a boss, a bank representative — and plays that voice in a phone call to extract money or information. In February 2024, the FCC confirmed that calls using AI-generated human voices fall under the Telephone Consumer Protection Act’s restrictions on artificial or prerecorded voices, meaning such calls require prior consent from the recipient.3Federal Communications Commission. FCC Confirms That TCPA Applies to AI Technologies That Generate Human Voices Using a cloned voice as part of a fraud scheme also triggers the same wire fraud and identity theft statutes that apply to any other spoofing method.
Financial market spoofing. Spoofing has a separate, specific meaning in trading. Under the Commodity Exchange Act, it is illegal to bid or offer with the intent to cancel before execution.4Office of the Law Revision Counsel. 7 U.S. Code 6c – Prohibited Transactions The trader places large orders they never plan to fill, creating the illusion of heavy demand or supply. Other traders adjust their prices in response. The spoofer cancels the fake orders and executes real trades at the moved price. The Commodity Futures Trading Commission prosecutes these cases, often alongside the Department of Justice; in one action, two traders received prison sentences of two years and one year for spoofing in precious metals futures markets.5U.S. Commodity Futures Trading Commission. CFTC Enforcement Updates
When Spoofing Is Illegal
The central federal statute is the Truth in Caller ID Act, codified at 47 U.S.C. § 227(e). It makes it unlawful for any person — inside or outside the United States, when the recipient is in the United States — to cause any caller identification service to transmit misleading or inaccurate information with the intent to defraud, cause harm, or wrongfully obtain anything of value.6Office of the Law Revision Counsel. 47 U.S. Code 227 – Restrictions on Use of Telephone Equipment The statute reaches voice calls and text messages. The FCC enforces it through civil forfeitures, and state attorneys general can bring civil actions on behalf of residents.
Changing a displayed number, by itself, is not the crime. The intent is. Without the fraudulent, harmful, or theft-related purpose, altering caller ID does not violate the statute.
Email: The CAN-SPAM Act
The CAN-SPAM Act handles email spoofing. Under 15 U.S.C. § 7704, it is unlawful to send a commercial email with header information that is materially false or materially misleading. Header information is misleading if it fails to accurately identify the sending computer because the sender knowingly used another computer to disguise the email’s origin. The statute also prohibits deceptive subject lines in commercial emails.7Office of the Law Revision Counsel. 15 U.S. Code 7704 – Other Protections for Users of Commercial Electronic Mail
Wire Fraud and Identity Theft
When spoofing is one piece of a scheme to steal money or personal information, federal prosecutors usually charge the underlying fraud, not just the spoofing. Wire fraud under 18 U.S.C. § 1343 carries up to 20 years in prison, or up to 30 years if the scheme affects a financial institution.8Office of the Law Revision Counsel. 18 U.S. Code 1343 – Fraud by Wire, Radio, or Television If the spoofer uses someone else’s identifying information during the fraud, aggravated identity theft under 18 U.S.C. § 1028A adds a mandatory two-year sentence that runs consecutively, meaning it is served on top of the underlying sentence rather than at the same time.9GovInfo. 18 U.S. Code 1028A – Aggravated Identity Theft
When Caller ID Alteration Is Legal
The Truth in Caller ID Act carves out specific exceptions. Federal, state, and local law enforcement agencies may alter caller identification information as part of a lawfully authorized investigative, protective, or intelligence activity. A court order can also authorize the practice in connection with an investigation.6Office of the Law Revision Counsel. 47 U.S. Code 227 – Restrictions on Use of Telephone Equipment
Beyond those exceptions, ordinary uses of caller ID alteration are lawful because they lack the fraudulent intent the statute requires. A doctor who displays a practice’s main office number instead of a personal cell, or a domestic violence survivor who masks a callback number for safety, is not violating the law. The legal line is drawn at intent.
Penalties
Civil forfeitures imposed by the FCC under the Truth in Caller ID Act can run into the hundreds of millions of dollars. The agency has imposed a $225 million forfeiture against a Texas-based telemarketing operation for roughly one billion illegally spoofed robocalls, a $120 million penalty on a Florida company for “neighbor” spoofing, and an $82 million fine against a North Carolina health insurance telemarketer.10Federal Communications Commission. Chairwoman Rosenworcel Archive: Fighting Robocalls and Spoofing These penalties stack per violation, so large operations face the heaviest totals.
Criminal penalties under the Truth in Caller ID Act include fines of up to $10,000 per violation for anyone who willfully and knowingly transmits misleading caller identification information.6Office of the Law Revision Counsel. 47 U.S. Code 227 – Restrictions on Use of Telephone Equipment The exposure grows sharply when spoofing is tied to a wider fraud. A wire fraud conviction alone can carry up to 20 years in prison, and courts routinely order defendants to pay restitution for money obtained through the scheme.8Office of the Law Revision Counsel. 18 U.S. Code 1343 – Fraud by Wire, Radio, or Television
If You’ve Been Targeted
For a spoofed call or text, you can file a complaint with the FCC through its Consumer Complaint Center. Select the category that fits your issue, describe what happened, and submit the form. The FCC uses complaints to spot patterns and build enforcement cases, though you may not get individual updates on your filing.11FCC Consumer Help Center. Filing a Complaint Questions and Answers
If a spoofed email caused a financial loss, especially a business email compromise where a forged message tricked someone into wiring money, report it to the FBI’s Internet Crime Complaint Center at ic3.gov. Call your bank right away and ask them to contact the receiving institution.12Federal Bureau of Investigation. Business Email Compromise Speed matters: the faster the alert goes out, the better the chance of recovering funds before they move out of reach.
To reduce the risk of becoming a target in the first place, the FBI recommends that you never click links or attachments in unsolicited emails or texts, even from an apparently familiar source. If a call or message claims to be from your bank or a government agency, look up the organization’s number independently rather than using any contact information in the message. Check email addresses and URLs carefully for small misspellings or substituted characters. Turn on two-factor authentication so a stolen password alone cannot open your accounts. Be careful what personal details you share on social media, since pet names, schools, and family members can help a scammer guess passwords or answer security questions. Legitimate companies generally do not contact you to ask for your username or password; a message that does is a red flag no matter who it appears to come from.13Federal Bureau of Investigation. Spoofing and Phishing