Scam calls, caller ID spoofing and the new Sender ID rules

The scale of the problem

Scam calls are the reason so many people no longer answer unknown numbers. According to the ACMA, telcos blocked more than 176.9 million scam calls and 55.1 million scam SMS in April–June 2026 alone, bringing the total to more than 4.2 billion scams blocked since the anti-scam rules came into force.

VoIP is part of both the problem and the solution. Internet telephony makes it cheap to place calls from anywhere and to set any number as the caller ID. That's what makes spoofing possible. But the same networks are now monitored, traced and filtered far more aggressively than a decade ago.

The rules telcos follow

Reducing Scam Calls and Scam SMs code

Industry Code C661:2022 requires Australian telcos to identify, trace and block scam calls and SMS, and to share information about scam traffic. The ACMA can take action when a provider breaches it, and has directed smaller VoIP wholesalers to comply after scam calls were found crossing their networks.

SMS Sender ID Register

The SMS Sender ID Register went live on 1 July 2026. Organisations that send texts using a branded name instead of a number must register that sender ID through their messaging provider. Texts with a registered sender ID display as normal. Texts using an unregistered sender ID are marked "Unverified", which most recipients will treat as a scam.

Mobile number porting checks

Telcos must carry out additional identity verification before porting a mobile number, to stop scammers hijacking numbers to intercept security codes. The ACMA has issued substantial penalties to providers that skipped these checks.

What this means for your business

If you send branded SMS

• Confirm your messaging platform has registered your sender ID(s). If you missed the July deadline, do it now.
• Make sure your business name, ABN and domain details line up, since verification checks them.
• Keep the number of sender IDs small and consistent so customers learn to recognise them.

If you make outbound calls

• Present a consistent, local or 1300 number that customers can call back and that appears on your website.
• Only present numbers you own or are authorised to use. Providers block calls presenting numbers you aren't entitled to.
• If you use an overseas call centre or dialler platform, make sure its traffic enters Australia through a compliant carrier with your authorised numbers.
• Tell customers what you will never ask for on a call, such as passwords, one-time codes or full card numbers.

If your own number is being spoofed

If customers report calls "from you" that you didn't make, your number is probably being spoofed. Contact your provider: they can report it into the industry tracing process. Warn customers via your website and social channels, and report to Scamwatch.

What about STIR/SHAKEN?

In the United States and Canada, carriers digitally sign calls using a framework called STIR/SHAKEN so the receiving network can check whether the caller ID is genuine. Australia has relied on the industry code and network-level blocking instead, though call authentication continues to be discussed. For now, the practical defence is the one above: use recognisable numbers and teach customers how you'll contact them.