European policing agencies have called for a concerted effort to crackdown on a surge in spoofing.

Europol has issued a new position paper in which it said spoofing, specifically caller ID spoofing, drives financial fraud and enables social engineering scams, resulting in substantial economic and societal damage, with an estimated EUR 850 million lost worldwide annually.

Phone calls and texts are primary attack vectors, accounting for approximately 64% of reported cases. This is done by deliberately manipulating the information displayed on a user’s caller ID, often using Voice over Internet Protocol (VoIP) services or specialised apps, to show a false name or number that appears legitimate and trustworthy. The ability of malicious actors to conceal their true identity and origin, severely impedes the capacity of law enforcement agencies (LEAs) to trace and prosecute cybercriminals.

In response Europol is calling for a coordinated European response to tackle caller ID spoofing.

“Caller ID spoofing is increasingly exploited by organised criminal networks operating across multiple jurisdictions,” a Europol spokesperson said. “Fraudsters impersonate banks, government agencies, or even family members to gain trust. Some use it for so-called swatting incidents, making false emergency calls from a victim’s address, triggering large-scale emergency responses.”

The report explained investigations show the emergence of a “spoofing-as-a-service” business model, providing ready-made tools for impersonating trusted entities such as law enforcement or financial institutions. Operating from abroad, these networks exploit jurisdictional gaps to evade detection and prosecution.

“The current imbalance, where spoofing is easy to commit but hard to investigate, is unsustainable,” it added. “Europol is urging measures that make it more costly and technically complex for criminals to hide behind spoofed identities, while enabling investigators to act swiftly across borders.”

A Europol survey conducted across 23 countries revealed significant challenges in implementing anti-caller-ID spoofing measures. This means that the combined population of approximately 400 million people remain susceptible to these types of attacks.

Law enforcement highlighted major obstacles, including limited cooperation with telecom operators, fragmented regulations, and a lack of technical tools to identify and block spoofed calls.

Europol said it and its partners have identified three priorities:

• Harmonised technical standards: develop EU-wide mechanisms to trace fraudulent calls, verify legitimate caller IDs, and block deceptive traffic.
• Enhanced cross-border collaboration: strengthen cooperation between law enforcement, regulators, and industry to share intelligence and evidence efficiently.
• Regulatory convergence: align national rules to enable lawful traceback, clarify legitimate uses of caller ID masking, and promote proven anti-fraud tools.

“While anti-spoofing measures are essential, law enforcement expects criminals to adapt,” the study added. “Emerging threats such as SIM-based scams, anonymous prepaid services, and smishing schemes will require continued vigilance and cross-sector cooperation.”

In order to effectively combat caller ID spoofing, Europol has called for harmonised technical standards for traceback and spoofing detection, enhanced cross-border collaboration among LEAs, regulators and industry, and aligned regulatory frameworks in order to facilitate legitimate traceback requests and anti-spoofing measures.

“These efforts directly align with the key objectives of the ProtectEU strategy, safeguarding societies and democracies from online and offline threats and enhancing the EU’s capacity to combat organised crime,” Europol continued. “Furthermore, recognising that caller ID spoofing is a primary enabler of online fraud, these measures contribute to the commitment under the ProtectEU strategy for combatting this serious crime through strengthened prevention, more effective law enforcement action and victim protection.

“Through multi-stakeholder collaboration, to address emerging threats and develop effective countermeasures, digital security can be significantly enhanced. This will ensure citizens are better protected from the adverse effects of caller ID spoofing.”