Why does an incoming call showing your company's own number prove nothing about the caller?

## The field is filled in by the person you are trying to identify Telephone identity is the oldest unauthenticated identity claim still in daily use, and it is load-bearing in more places than anybody documents. Understanding *who writes the value* is the whole answer. In SIP, the calling user agent constructs the `From` header, and it contains both a number and an optional display name. It is data authored by the calling side. That is not a bug in the sense of a defect to be patched; SIP was designed for a world of interconnected, mutually trusting operators, and the header is a courtesy field. Networks bolted assurance on afterwards, in layers: - **`P-Asserted-Identity`** is inserted by the *originating* network for a subscriber it believes it has authenticated. It is meaningful **only inside a trust domain** - a set of operators that have agreed to honour each other's assertions - and is meant to be stripped or ignored when the call leaves that domain. A value that arrives from outside tells you what somebody chose to send. - **Display name** reaches the handset by one of two routes: the caller's own `From` display name, or a lookup performed by the terminating side keyed on the *asserted calling number*. Both routes bottom out in something the caller supplied, which is why spoofing a number spoofs the name for free. If the receiver's handset has the number saved as a contact, it will helpfully show *their own* label for it, which makes the illusion stronger, not weaker. - **STIR/SHAKEN** is the real cryptographic addition: the originating provider signs a PASSporT token carried in an `Identity` header, and the terminating provider verifies it. The token carries an **attestation level**. *Full* attestation asserts the provider authenticated its customer and that the customer is entitled to use the calling number. *Partial* asserts the customer is known but the number is not confirmed. *Gateway* asserts only that the signer put the call onto the network - typical for traffic arriving through international gateways. Deployment is patchy and jurisdictional, and what the receiving person sees, if anything, is a coarse indicator. Even at its best, this scheme authenticates a **number and a subscriber relationship**. It does not authenticate a **person**. A perfectly attested call can be placed by an operator sitting at a compromised or rented business line, and the human on it is whoever they say they are. ## The asymmetry that actually gives you something There is one telephony property that survives all of this: **a number you dial is a property of the destination; a number you answer is a claim by the source.** When you originate a call to a number, routing delivers you to whoever holds that number. Nothing the impersonator does to the presentation of their outbound call affects where your outbound call lands. That is why an identity claim made on a call you received cannot be settled inside that same call, and why the value of the number depends entirely on which direction it was used in. A number the caller reads out to you is not a number you hold; it is another caller-supplied field, just with extra steps. ## Where this bites in practice The damage is rarely a formal control keying off caller ID. It is the informal ones: the desk that skips a step for an internal-looking call, the approver who accepts verbal confirmation "because the number was ours", the reception that transfers a call inward because the display said the name of a supplier everyone recognises. None of these are written down, so none of them get reviewed, and all of them consume a caller-supplied identifier. A second-order effect matters too. Because the display name is derived from the number, an operator who spoofs a supplier's main switchboard number inherits the supplier's *brand* on the handset. The receiver is not reasoning about telephony at all at that point - they are reading a name they trust. ## What to say when asked Name who fills the field in, name the two additions (`P-Asserted-Identity` inside a trust domain, STIR/SHAKEN attestation across domains), state precisely what full attestation asserts and what it does not, and finish on the asymmetry: dialling is evidence, answering is not. Then make the operational point - the fix is not to get better at judging a presented number, it is to ensure no step in the process consumes one.