Europol says caller ID spoofing has become a persistent enabler of financial and social engineering crime across Europe, estimating global losses at about EUR 850 million a year and noting that phone and text-based fraud account for roughly two thirds of reported scam cases.
Attackers use Voice over IP services and dedicated apps to make calls appear to come from trusted sources such as banks, government agencies or family members, with the objective of stealing money or data. In Finland, telecom operator Elisa reported that before new anti-spoofing measures were introduced up to 90% of incoming weekday calls from abroad were fraudulent, with many appearing to originate from local numbers and timed for office hours.
Law enforcement officials say spoofing facilitates a range of crimes, including tech support scams, bank impersonation, fraudulent transfers and false emergency calls known as swatting. Organised groups often operate across borders or from countries with low prosecution risk, and some run spoofing-as-a-service operations that lower the technical barrier for individual scammers.
Europol collected input from 23 EU member states and identified widespread obstacles to anti-spoofing efforts, including weak collaboration with telecom operators and regulators, limited resources and unclear mandates. Investigators reported difficulty obtaining technical data and often lack direct contacts at operators; the agency said about 400 million people remain exposed to spoofing-related scams.
The agency’s position paper calls for EU-wide technical standards to identify and block spoofed calls and proposes a neutral international traceback system to follow calls across networks. The paper also urges member states to align legal frameworks so investigators know who can issue traceback requests and what data may be shared, while noting that authentication approaches such as STIR/SHAKEN are being tested and may not suit every legal or privacy context.
Europol warns criminals are shifting tactics toward SIM-based scams, anonymous prepaid services and callback frauds, and says smishing remains an ongoing risk that requires updated filtering and detection. The agency recommends stronger Know Your Customer and Know Your Transaction checks by operators and frames caller ID spoofing mitigation as part of the EU’s wider security strategy under ProtectEU, noting that rebuilding trust will require cooperation among public authorities, telecom providers and the cybersecurity community.