Caller ID Rules for Businesses: Spoofing, STIR/SHAKEN, Spam Labels

A business that telemarkets has to send caller ID with every sales call: a number that reaches someone who can take a do-not-call request and, when its carrier can carry one, a name. Knowingly sending misleading caller ID to defraud, cause harm, or wrongfully obtain something of value is a separate violation. For a legitimate caller, the practical risks include blocking and “Spam Likely” labels, plus caller ID counts in TCPA complaints. Good records of the company’s caller ID setup help with each.

What does federal law require a business to show on caller ID?

A working callback number, and a name when the carrier can carry one. The FCC’s rule says “Any person or entity that engages in telemarketing, as defined in section 64.1200(f)(10) must transmit caller identification information,” under 47 C.F.R. § 64.1601(e). That means the calling party number or the billing number (ANI) and, when the telemarketer’s carrier makes it available, the telemarketer’s name. A seller can substitute its own name and customer service number for the name and number used to place the call, but “The telephone number so provided must permit any individual to make a do-not-call request during regular business hours.”

The same rule bars hiding the number: “Any person or entity that engages in telemarketing is prohibited from blocking the transmission of caller identification information.” Tax-exempt nonprofits are exempt. Our post on nonprofit and political calls covers the other TCPA rules that apply to them.

The FCC’s 2003 TCPA order, which adopted the rule, describes a safety valve that the rule text itself doesn’t contain. If caller ID doesn’t reach the consumer “through no fault of the telemarketer originating the call, then the telemarketer will not be held liable for failure to comply with the rules.” The catch comes in the next sentence: the telemarketer “must provide clear and convincing evidence that the caller ID information could not be transmitted.” Keep carrier tickets and configuration records.

At least one court has applied the requirement to texts. In Newell v. JR Capital, LLC, a federal court in Philadelphia wrote, “I conclude that a private cause of action exists, the regulation covers text messages,” and concluded, at the pleading stage, that a link to a website whose domain differed from the company’s name was not “the name of the seller.”

When does a business’s caller ID become illegal spoofing?

When a business knowingly sends misleading caller ID with the intent the statute requires. The Truth in Caller ID Act, codified at 47 U.S.C. § 227(e), bars causing a caller ID service to knowingly transmit misleading or inaccurate caller ID information “with the intent to defraud, cause harm, or wrongfully obtain anything of value.” Congress amended it in 2018 to cover text messages and calls from outside the United States to people here, changes the FCC adopted in an August 2019 order. The FCC’s version of the rule is 47 C.F.R. § 64.1604.

That intent requirement protects a lot of ordinary business practice. The FCC’s 2011 order implementing the Act said “manipulation or alteration of caller ID information done without the requisite harmful intent does not violate the Act.” Commenters had asked the FCC to exempt, or at least clarify, the practice of manipulating caller ID to show a local number. The FCC declined to create an exemption but agreed in a footnote: “We agree that such a practice is not in and of itself a violation of the Act.” The same footnote warned that displaying a spoofed local number “as part of a scheme to defraud, cause harm, or wrongfully obtain anything of value” violates the Act.

Neighbor spoofing is a different matter. The FCC has described it as showing “a phone number similar to the called party’s number, for example using the same area code and exchange, to increase the chance that the called party will answer,” in a 2019 declaratory ruling. In its 2018 forfeiture order against Adrian Abramovich and his marketing companies, the FCC imposed a $120,000,000 penalty for what it called “one of the largest spoofed robocall campaigns that the Commission has ever investigated.” The order describes local-looking caller ID on calls pitching vacation deals “purportedly offered by a well-known travel or hospitality company.” In my view, the strongest practical position is a business that has the right to use every number it displays and routes each one back to itself, which leaves little for a regulator or a plaintiff to read as a disguise.

Who enforces the caller ID rules, and can a consumer sue?

Spoofing under § 227(e). The statute provides for FCC forfeitures, criminal penalties, and state enforcement. The statute capped FCC forfeitures at $10,000 per violation. After inflation adjustments, the FCC’s rule at 47 C.F.R. § 1.80 lists $14,432 per violation and $43,296 per day of a continuing violation, capped at $1,443,275 for any single act or failure to act. Willful and knowing violations can bring criminal fines on conviction, and a state attorney general can sue in federal court on behalf of the state’s residents. Our post on traceback requests and state attorney general suits covers how those inquiries usually start. There’s no private damages claim. A federal court in San Francisco dismissed a consumer’s spoofing claims with prejudice in Brosnan v. National Loan Center, No. 15-cv-03487-JCS (N.D. Cal. Oct. 26, 2015), on initial review of a pro se complaint, on the ground that the Act provides no private right of action.

Missing or blocked caller ID under § 64.1601(e). The FCC enforces this rule too. Whether a consumer can sue over it depends on whether the FCC adopted the rule under § 227(c), which includes a private right of action, or under § 227(d), which doesn’t. For years, federal courts said no. In Griffin v. American-Amicable Life Insurance Co. of Texas, No. 6:24-cv-00243-MC (D. Or. Sept. 27, 2024), the court followed “the reasoning of every federal court to consider the issue” and found that, “while no private right of action exists” for violating the caller ID rule, the plaintiffs’ other TCPA claims could proceed. It dismissed the caller ID claim with prejudice.

In 2025, a minority of federal courts disagreed. One was Newell (E.D. Pa. July 16, 2025), which let the claim go forward under § 227(c)(5). On October 9, 2025, the federal court in Tacoma took the same view of the private-claim question in Barton v. Bright Solar Marketing LLC, No. 3:25-cv-05310-DGE (W.D. Wash.), while acknowledging “there is a difference of opinion among district courts” and that district courts had typically found no private right. Barton dismissed the complaint on other grounds, as an improper shotgun pleading with leave to amend, and said the amended complaint could include the caller ID claim.

Where a court allows the claim, the plaintiff needs more than one call within 12 months by or on behalf of the same entity in violation of the FCC’s § 227(c) rules, and can seek actual losses or up to $500 per violation, whichever is greater, or up to $1,500 if the court finds the violation willful or knowing, under 47 U.S.C. § 227(c)(5). I’d raise the no-private-right argument in a motion to dismiss in any court. Most decisions support it, but the 2025 rulings show it can lose, so a company shouldn’t build its caller ID practices around the argument winning.

How does STIR/SHAKEN attestation affect whether calls get through?

STIR/SHAKEN is the industry standard for authenticating caller ID on internet-protocol networks, and the FCC required voice providers to implement it by June 30, 2021, subject to certain extensions and exemptions, under 47 C.F.R. § 64.6301. The obligations fall on voice service providers and intermediate providers, not on the businesses placing calls through them, and the rules address calls, not text messages.

The provider that signs a call, usually the originating provider, assigns it an attestation level. As the FCC explained in its 2020 STIR/SHAKEN order, full (“A”) attestation means the provider can confirm the customer’s identity and that the customer is using its associated number; partial (“B”) means it can confirm the customer but not the number; and gateway (“C”) means the provider is only the point where a call from elsewhere entered its IP network. The same order noted a concern raised by commenters: when a company places outbound calls through a provider other than the one that assigned its numbers, the calls may have trouble getting full attestation.

Attestation matters because a carrier that wants the FCC’s blocking safe harbor has to consider it. To block without liability under the analytics safe harbor in § 64.1200(k)(3), a terminating provider must meet several conditions, including this one: “Those analytics include consideration of caller ID authentication information where available.” The FCC tightened the signing rules in its Eighth Caller ID Authentication Report and Order in November 2024, requiring providers that use a third party to sign calls to make the attestation decisions themselves and use their own certificates. The Wireline Competition Bureau’s public notice announced that compliance was required by September 18, 2025.

The practical takeaway: ask your carrier, in writing, what attestation level your outbound calls receive. If the answer is B, one cause commenters raised in the 2020 order is a mismatch between the provider that holds your numbers and the one that places your calls. A C usually means a gateway or intermediate provider signed the call instead of your own carrier, so ask your carrier why it isn’t signing your calls at origination.

Why do legitimate calls get labeled “Spam Likely,” and what fixes it?

Risk labels like “scam likely” “are generally based on analytics,” the FCC observed in a May 2023 notice. In its 2019 ruling, the FCC listed factors a reasonable blocking program might use, including “large bursts of calls in a short timeframe; low average call duration; low call completion ratios,” along with complaint volume, sequential dialing, neighbor spoofing patterns, and comparison against the National Do Not Call Registry.

Labels get less regulatory protection than blocking. In its December 2020 order, the FCC wrote: “We decline to extend redress mechanisms to erroneous call labeling at this time.” It encouraged carriers and their analytics partners to work with callers in good faith, but it didn’t require them to. The 2023 notice asked for comment on labeling again, including whether the FCC could make labels more accurate for callers, but the rules in effect as of this post contain no redress requirement aimed at labels as such. Blocking is different. A terminating provider that blocks calls must offer a single point of contact for complaints, and once it agrees a credible complaint of erroneous blocking is right, it “must promptly cease the call treatment for that number unless circumstances change,” under § 64.1200(k)(8). The FCC’s 2020 order extended the point-of-contact duty to a provider that doesn’t block but uses attestation information in deciding how to deliver calls. Under § 64.1200(k)(9), a provider that blocks based on analytics must send back a response code (SIP 603, 607, or 608 on IP networks). In a February 2025 order, the FCC made SIP code 603+ the exclusive code for analytics-based blocking on IP networks, effective March 25, 2026, so make sure your platform will recognize it.

Have your dialer or platform log those response codes, because they may be the only real-time sign that calls are being blocked. Also, don’t rotate numbers to shed labels. In my view, rotation produces numbers with no reputation and many short calls, the pattern analytics look for, and numbers that stop working put you crosswise with the callback requirement. In its 2003 order, the FCC said “Any number supplied must permit an individual to make a do-not-call request during regular business hours for the duration of the telemarketing campaign.” I think heavy number rotation is the caller ID habit most worth breaking, because it invites the very labels it’s meant to escape.

How do caller ID records help a business defend a TCPA case?

They speak to the questions that drive damages. Section 227(c)(5) gives a defendant an affirmative defense if it “has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations” in violation of the FCC’s § 227(c) rules, and the same subsection ties the higher damages to a finding that the violation was willful or knowing. Records showing which numbers you use, who assigned them, what name your carrier transmits, and that every number reaches a live line or a working opt-out speak to both.

When a claim mentions caller ID, pull these together:

1. Preserve the call and text logs, dialer and platform data, and the consent records for the numbers named in the claim, under a litigation hold the day the claim arrives.
2. Pull the internal do-not-call and opt-out logs, with the date each request came in and the date the number was suppressed.
3. Pull the National Do Not Call Registry scrub records and the version dates used for each campaign.
4. Collect the vendor and carrier contracts, call scripts, number inventory, caller ID name registrations, and any carrier correspondence about attestation, blocking, or labels.
5. Talk to a lawyer before you answer a demand letter, call the claimant, or offer anything to settle.

For claims involving caller ID and Do Not Call compliance, the firm’s California TCPA defense page sets out what the defense looks at first.

Exposure and defenses at a glance

Questions businesses ask about caller ID

Can we display a local number when calling customers in another area code?

Under federal law, generally yes. The FCC said in 2011 that showing a local number is not by itself a violation of the Truth in Caller ID Act, where the question is intent. Separately, a telemarketing call’s displayed number must let people make do-not-call requests during business hours. The safest setup uses numbers the business has the right to use and that route back to it.

Do the caller ID rules apply to text messages?

The spoofing ban does. The statute names text messaging services expressly. Whether the telemarketing caller ID rule in § 64.1601(e) does is a newer question, and the Newell court said yes at the pleading stage. Marketing texts should identify the business by name.

Can a consumer sue us for spoofing?

Not under the Truth in Caller ID Act. That statute is enforced by government, not consumers, and courts have dismissed private spoofing claims. A consumer can, however, allege a violation of the telemarketing caller ID rule as part of a TCPA case, and some courts allow that claim.

If your company is facing a caller ID claim

If your company is accused of sending blank, blocked, or misleading caller ID, the number inventory and carrier records you keep now will shape the defense. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving caller ID and Do Not Call compliance. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is 47 U.S.C. § 227. The FCC’s rules are 47 C.F.R. § 64.1601, § 64.1604, § 64.1200, § 64.6301, § 64.6302, and § 1.80, each as published in the eCFR through October 15, 2025.

The FCC orders are the 2003 TCPA Report and Order (FCC 03-153); the Truth in Caller ID Report and Order (FCC 11-100); the Truth in Caller ID implementation order for RAY BAUM’S Act (FCC 19-73); the Abramovich Forfeiture Order (FCC 18-58); the 2019 Declaratory Ruling on call blocking (FCC 19-51); the 2020 STIR/SHAKEN Report and Order (FCC 20-42); the Fourth Report and Order on call blocking (FCC 20-187); the Eighth Caller ID Authentication Report and Order (FCC 24-120); the Seventh Report and Order, Eighth Further Notice of Proposed Rulemaking, and Third Notice of Inquiry (FCC 23-37); the Eighth Report and Order on call blocking (FCC 25-15); and the Wireline Competition Bureau’s effective-date notice (DA 25-730).

The court decisions are Newell v. JR Capital, LLC, No. 25-1419 (E.D. Pa. July 16, 2025); Barton v. Bright Solar Marketing LLC, No. 3:25-cv-05310-DGE (W.D. Wash. Oct. 9, 2025); Griffin v. American-Amicable Life Insurance Co. of Texas, No. 6:24-cv-00243-MC (D. Or. Sept. 27, 2024); and Brosnan v. National Loan Center, No. 15-cv-03487-JCS (N.D. Cal. Oct. 26, 2015).

This post is general information about the Telephone Consumer Protection Act and related laws as of October 15, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.