Telephone spoofing: what it is and how to protect yourself

Receiving a call that seems to come from a known number, such as that of a bank, an Energy company or even your telephone operator, and discovering that it is fraud: this is the typical scenario of telephone spoofing. 

The number shown on the display does not correspond to who is really calling, because it is intentionally falsified to deceive the person receiving the call. Understanding how this mechanism works makes it possible to develop greater digital awareness, useful for safeguarding your privacy. 

What is telephone spoofing?

Telephone spoofing is a technique with which the person making a call manipulates the information transmitted to the network, replacing their own number with a different one, chosen arbitrarily. The result is that a number that does not actually belong to the caller appears on the recipient’s display.

This is possible because some telephone technologies, particularly those based on VoIP protocol (Voice over IP), do not automatically verify the caller’s identity. The technique does not require physical access to the victim’s device: it is enough to use certain online services or specific software to modify the calling number before the call reaches the recipient. In Italy, as throughout the European Union, the practice is prohibited when used for fraudulent purposes, but its spread has grown in recent years, particularly in the sector of scams linked to utility, banking and insurance services.

How to recognize a fake call?

There is no infallible signal that distinguishes an authentic call from one with a spoofed number, but there are elements that should raise your guard. Scammers who use spoofing build credible scenarios, often simulating urgency or presenting imminent risks. Some recurring signs in suspicious calls are:

• the caller asks you to confirm or provide personal data, access codes or bank details;
• a sense of emergency is created, such as an account being blocked, supply being interrupted or a suspicious transaction;
• the tone is insistent and leaves no room for checks or pauses to think;
• immediate actions are requested, such as a bank transfer, installation of an app or reading out an OTP code.

It should be kept in mind that legitimate companies, including Energy companies such as Enel, never ask during a telephone call for access data to the personal area, bank details or security codes linked to your accounts. Another useful signal is the behaviour of the number itself: if you call back the number displayed and no one answers, or an unaware person answers, it is likely to be spoofing.

Vishing too, a variant of spoofing that combines voice calls and social engineering, follows similar patterns: the scammer collects information about the victim in advance to make the call more convincing, citing real data such as name, address or contract number.

What to do if you receive a suspicious call?

The most effective response to spoofing is to end the call and verify independently. The recommended actions to take immediately are:

• never provide personal data, access codes, IBANs or OTP codes during an unexpected telephone call;

• hang up and call the official number of the company or service directly, available on the institutional website or on the contract;

• do not call back the number that called you, because it may still be under the scammer’s control;

• report the number to the Postal Police through the commissariatodips.it portal;

• submit a report to AGCOM if you suspect unlawful use of the telephone system.

If you have already unintentionally provided some information, it is important to act quickly: contact your bank to block any suspicious transactions and change the passwords of the accounts involved. In the event of confirmed economic damage, it is advisable to file a report with the competent authorities.

The protections of the Decreto Bollette against unwanted commercial calls

Alongside spoofing, which concerns the technical falsification of the calling number, there is a distinct but connected regulatory area: the rules introduced by the Decreto Bollette (Decree-Law 21/2026, converted into Law 49/2026), in force since June 19, 2026, which strengthen consumer protection against unsolicited commercial calls in the Power and gas sector.

The new provisions establish that a supplier may propose commercial offers by telephone only if the consumer has already expressed explicit consent to receive them, or if they are not yet a customer and have shown interest through the professional’s digital channels, such as website or app. Calls must also come from a callback number that uniquely identifies the contacting company. Contracts concluded without complying with these requirements are null and void.

Some signs help recognize a suspicious call:

• the caller pressures you to subscribe to an offer immediately;

• they cannot clearly explain the characteristics of the proposal;

• they introduce themselves generically, without identifying the company they work for;

• they talk about alleged obligations or automatic tariff changes;

• they request personal data without providing adequate explanations.

In case of doubt, it is always advisable to take the time needed to verify what you have received, also by consulting the dedicated Enel page on recognizing and preventing scams in the Energy sector.

How to reduce the risk: tools and behaviours

There is no technical solution that definitively blocks spoofing, but combining digital tools and conscious behaviours significantly reduces vulnerability. Some practical measures to adopt:

• activate the anti-spam filter in your smartphone settings, available on iOS and Android, or through your telephone operator;

• use call identification apps that cross-check numbers with reporting databases, such as Truecaller or the functions integrated into recent mobile operating systems;

• do not publish your telephone number on unnecessary public platforms, reducing the data collection surface for scammers;

• register with the Registro delle Opposizioni, which reduces unwanted commercial calls and limits exposure to unsolicited contacts;

• periodically stay updated on the most widespread scam techniques, because methods change frequently.

Awareness remains the strongest defense: knowing that a displayed number is not a guarantee of identity is already a significant step toward greater security.

Protect yourself from spoofing with Enel

It is useful to know that Enel never asks, during an unscheduled telephone call, for access credentials to the personal area, bank details, OTP codes or the signing of contracts by voice without a documented process.

True closeness to citizens and protection against scams pass first and foremost through information and direct dialogue. This is precisely the objective behind Energy bar, a programme of training meetings and in-depth sessions organized directly in Spazi Enel and selected Spazi Enel Partner throughout Italy. 

These appointments, free of charge and open to everyone, are designed to offer real conversations on everyday topics. Taking part in these initiatives allows you to clarify any doubts, learning to recognize official contact channels and acquiring the tools needed to defend yourself effectively against the dangers of telephone scams. 

Frequently asked questions